Overview

overview

10

Static

static

10

07a16c6ffa...bf.exe

windows7_x64

10

07a16c6ffa...bf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07a16c6ffa9aa2ee78191217a9ef62bbf330326633be76aa80985f65143781bf

  • Size

    89KB

  • Sample

    220212-mca1tabah4

  • MD5

    fac263bf397ebdf16e922a763f5e372e

  • SHA1

    b7499e0d72e91a69008c8bd5fe8a292a59cabfb3

  • SHA256

    07a16c6ffa9aa2ee78191217a9ef62bbf330326633be76aa80985f65143781bf

  • SHA512

    7fda852217510d3b0a258778daaad898494d7e563478fa5ba8fc2948c5a55d7fe9a75ea8e1bfa15f596b4885b71458f2286df87ed2ccba67e63d7717f9ce854c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07a16c6ffa9aa2ee78191217a9ef62bbf330326633be76aa80985f65143781bf

    • Size

      89KB

    • MD5

      fac263bf397ebdf16e922a763f5e372e

    • SHA1

      b7499e0d72e91a69008c8bd5fe8a292a59cabfb3

    • SHA256

      07a16c6ffa9aa2ee78191217a9ef62bbf330326633be76aa80985f65143781bf

    • SHA512

      7fda852217510d3b0a258778daaad898494d7e563478fa5ba8fc2948c5a55d7fe9a75ea8e1bfa15f596b4885b71458f2286df87ed2ccba67e63d7717f9ce854c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks